CVE-2026-55824
Received Received - Intake

Contao CMS Credential Leak via Crawler

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description
Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes Cookie and Authorization headers, but it removes the non-Symfony option names basic_auth and bearer_auth instead of Symfony HttpClient's real auth_basic and auth_bearer options. When contao.crawl.default_http_client_options contains Basic or Bearer authentication for a protected staging/production site, those credentials remain in the "clean" client used for external links or configured additional URIs. An attacker who can get an external URL crawled, for example through a link on a crawled page while the broken-link checker is enabled, can receive the crawler credentials. This issue has been fixed in versions 5.3.47 and 5.7.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-08-01
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-55824
EUVD
EUVD-2026-51613

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
contao contao 4.13.40
contao contao 5.3.46
contao contao 5.7.0-rc1
contao contao 5.7.6
contao contao 5.3.47
contao contao 5.7.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Contao CMS versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6 have a flaw in the crawler where authentication credentials are leaked to external hosts. The crawler attempts to remove sensitive headers like Cookie and Authorization when accessing external domains, but it incorrectly removes the wrong option names (basic_auth and bearer_auth instead of auth_basic and auth_bearer). This allows credentials configured for protected sites to be sent to external URLs during crawling.

Impact Analysis

If you use Contao CMS with authentication configured for staging or production sites, an attacker could exploit this by getting an external URL crawled. This could expose your credentials, potentially allowing unauthorized access to your protected sites or data. The attack requires an attacker to trick the crawler into visiting a malicious link.

Compliance Impact

This vulnerability could lead to unauthorized exposure of authentication credentials (Basic or Bearer tokens) during web crawling. If exploited, it may result in unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements for secure data handling and access controls.

Mitigation Strategies

Upgrade Contao to version 5.3.47 or 5.7.7 or later to fix the issue. Review and remove any Basic or Bearer authentication credentials from contao.crawl.default_http_client_options to prevent credential leakage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55824. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart